Publish on F-Droid

[goddaneel]

Can you publish on f-droid or izzyondroid？

[Irineu333]

What would be the benefit?

[goddaneel]

There are a lot of people who use this platform for software installations and updates, and I think your work is equally suitable for posting and distribution here.

[Irineu333]

I'll look into how to do it.

[goddaneel]

If you're experiencing difficulties, @IzzySoft may be able to help.

[IzzySoft]

Performing a quick scan on the APK:

Offending libs:
---------------
* Bugsnag exception reporter for Android (/com/bugsnag): Tracking

1 offenders.

Is Bugsnag opt-in, or enabled by default?

SigningBlock blobs:
-------------------
0x504b4453 (DEPENDENCY_INFO_BLOCK; GOOGLE)

This can be avoided by adding a few lines to your build,gradle:

android {
    dependenciesInfo {
        // Disables dependency metadata when building APKs (for IzzyOnDroid/F-Droid)
        includeInApk = false
        // Disables dependency metadata when building Android App Bundles (for Google Play)
        includeInBundle = false
    }
}

For some background: that BLOB is supposed to be just a binary representation of your app's dependency tree. But as it's encrypted with a public key belonging to Google, only Google can read it – and nobody else can even verify what it really contains. More details can be found e.g. here: Ramping up security: additional APK checks are in place with the IzzyOnDroid repo.

Now, testing for reproducibility (see e.g. Reproducible Builds, special client support and more at IzzyOnDroid for some background on that): it's not RB. Here's the diff of the APKs:

  -rw-r--r--  0.0 unx      120 b-      118 defN 1981-01-01 01:01:02 0178fe7b META-INF/version-control-info.textproto
- -rw-r--r--  0.0 unx     9743 b-     9743 stor 1981-01-01 01:01:02 54da1cd6 assets/dexopt/baseline.prof
+ -rw-r--r--  0.0 unx     9744 b-     9744 stor 1981-01-01 01:01:02 1469c593 assets/dexopt/baseline.prof
  -rw-r--r--  0.0 unx      548 b-      548 stor 1981-01-01 01:01:02 360ce833 assets/dexopt/baseline.profm
  -rw-r--r--  0.0 unx 31572244 b-  7156294 defN 1981-01-01 01:01:02 748fd292 classes.dex
- -rw-r--r--  0.0 unx 10850368 b-  3799578 defN 1981-01-01 01:01:02 4a2b1514 classes2.dex
+ -rw-r--r--  0.0 unx 10850324 b-  3799591 defN 1981-01-01 01:01:02 cbcc138b classes2.dex
  -rw-r--r--  0.0 unx  3550292 b-  1135080 defN 1981-01-01 01:01:02 dfe0c76b classes3.dex
  -rw-r--r--  0.0 unx    10096 b-    10096 stor 1981-01-01 01:01:02 9734baa0 lib/arm64-v8a/libandroidx.graphics.path.so
  -rw-r--r--  0.0 unx  1152136 b-  1152136 stor 1981-01-01 01:01:02 998f0200 lib/arm64-v8a/libbugsnag-ndk.so
@@ -244,7 +244,7 @@
  -rw----     0.0 fat     6616 b-     6616 stor 1981-01-01 01:01:02 1359de26 res/Lf.png
  -rw----     0.0 fat     1656 b-      421 defN 1981-01-01 01:01:02 7a03a080 res/Lf.xml
  -rw----     0.0 fat     1779 b-     1779 stor 1981-01-01 01:01:02 e97125d2 res/Li.9.png
- -rw----     0.0 fat   114629 b-    10484 defN 1981-01-01 01:01:02 154747fb res/M7.json
+ -rw----     0.0 fat   114630 b-    10485 defN 1981-01-01 01:01:02 85015cb9 res/M7.json
  -rw----     0.0 fat     1196 b-      397 defN 1981-01-01 01:01:02 91c0d808 res/M7.xml

Starting at the bottom: the M7.json is easy to fix, the issue there is the embedded timestamp:

    "metadata": {
        "generated": "2025-05-01T07:11:48.15Z"
    },

You use a Kotlin build.gradle.kts, so the fix would be inserting there:

aboutLibraries {
    excludeFields = arrayOf("generated")
}

(see e.g. here in our wiki.

Next, jumping to the top: baselines differ usually whenever one of the dex files differ (as it's the case here), due to the fact they include the checksums of those classes*.dex – so we can skip that here for now. Remains classes2.dex … ah, I should have expected that: you have secrets (from us) 😝

OK, with the above adjustments made, the app would also be RB – and we could add it to the IzzyOnDroid repo.

[linsui]

The timestamp has been disabled by default in latest version of aboutLibraries so you just need to update the lib.

[IzzySoft]

The timestamp has been disabled by default in latest version of aboutLibraries

Oh, nice! That saves us all some headaches. Thanks for sharing this good news, @linsui!

@Irineu333 please let us know when a new build is available, we can check again then and proceed with inclusion.

[linsui]

Can you add the fastlane structure? See https://gitlab.com/-/snippets/1895688